Analysis

  • max time kernel
    149s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    24-09-2021 11:55

General

  • Target

    RFQ_Beijing Chengruisi Manufacturing_pdf.exe

  • Size

    417KB

  • MD5

    a30b50f5e2ea1a2d8c6bdf581e97d478

  • SHA1

    9943026649061e28fe7fd626b6d3e1c893131779

  • SHA256

    3dafcb39d7cc251c9a8212a8e745e0d72f2c530bf699a9168a379fa25e36ec38

  • SHA512

    548ca8b3f795c32ff30d4f4810e78c6a0bb2aecf42a4bc56632612b2ab5595d9d4d3fd364b6c9bcca80135f1459f7243edc020a2b61bb3b1bce04d43d79a8088

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1680
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
        3⤵
        • Deletes itself
        PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1180-69-0x0000000006330000-0x0000000006497000-memory.dmp
    Filesize

    1.4MB

  • memory/1180-79-0x0000000007420000-0x000000000758A000-memory.dmp
    Filesize

    1.4MB

  • memory/1180-71-0x0000000004C60000-0x0000000004D24000-memory.dmp
    Filesize

    784KB

  • memory/1216-76-0x0000000000000000-mapping.dmp
  • memory/1680-70-0x0000000000240000-0x0000000000251000-memory.dmp
    Filesize

    68KB

  • memory/1680-68-0x0000000000200000-0x0000000000211000-memory.dmp
    Filesize

    68KB

  • memory/1680-66-0x000000000041D420-mapping.dmp
  • memory/1680-67-0x0000000000A20000-0x0000000000D23000-memory.dmp
    Filesize

    3.0MB

  • memory/1680-65-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1696-63-0x00000000055B0000-0x000000000560C000-memory.dmp
    Filesize

    368KB

  • memory/1696-59-0x0000000000190000-0x0000000000191000-memory.dmp
    Filesize

    4KB

  • memory/1696-64-0x0000000001F70000-0x0000000001F9C000-memory.dmp
    Filesize

    176KB

  • memory/1696-62-0x0000000000310000-0x0000000000314000-memory.dmp
    Filesize

    16KB

  • memory/1696-61-0x00000000002D0000-0x00000000002D1000-memory.dmp
    Filesize

    4KB

  • memory/2028-72-0x0000000000000000-mapping.dmp
  • memory/2028-73-0x0000000075211000-0x0000000075213000-memory.dmp
    Filesize

    8KB

  • memory/2028-74-0x0000000000A40000-0x0000000000A5C000-memory.dmp
    Filesize

    112KB

  • memory/2028-75-0x00000000000C0000-0x00000000000E9000-memory.dmp
    Filesize

    164KB

  • memory/2028-77-0x0000000001FF0000-0x00000000022F3000-memory.dmp
    Filesize

    3.0MB

  • memory/2028-78-0x0000000000900000-0x0000000000990000-memory.dmp
    Filesize

    576KB